SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,506 copies16 likes159,710 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the modification of an existing service's configuration (binpath or failure command) using 'sc.exe' or 'reg.exe' to execute an arbitrary payload. This is a common method for establishing persistence or escalating privileges by ensuring a malicious executable runs when the service starts or fails.
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee using 'sc.exe sdset'. This technique can be used by adversaries for privilege escalation or persistence by overriding existing access restrictions on Windows services.
Detects the creation of a scheduled task using the "-XML" flag with a file that does not have the '.xml' extension. This behavior is suspicious because it attempts to masquerade the XML configuration file, potentially as a defense evasion technique during persistence establishment. Adversaries might use this to hide their scheduled tasks from casual inspection.
This rule detects when a user is added to the local Administrators group on a Windows system. It specifically looks for command-line executions of 'net.exe' with 'localgroup <groupname> /add' or 'powershell.exe' with 'Add-LocalGroupMember -Group <groupname>', where the group name contains 'administrators' or 'administrateur'. This activity is often associated with privilege escalation or persistence techniques by adversaries.
Detects the execution of Sysinternals PsService, a utility that can be used for service reconnaissance, management, and potential tampering. This tool can be leveraged by adversaries for discovery, privilege escalation, or persistence by interacting with Windows services.
Detects uncommon child processes spawned by "userinit.exe". Legitimate child processes of userinit.exe typically include explorer.exe, logon scripts (like netlogon.bat, UsrLogon.cmd), PowerShell.exe on Windows Core, and specific Citrix or proquota.exe processes. The rule aims to identify suspicious or malicious executables launched by userinit.exe, which could indicate persistence mechanisms or privilege escalation attempts.
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration. This action can be used by adversaries to maintain persistence on a compromised account by preventing its password from expiring, thus avoiding the need to frequently update credentials.
This rule detects the creation or modification of a Windows service where the service binary's path is located in a suspicious directory. Adversaries often place malicious service executables in non-standard or temporary locations to evade detection and establish persistence. The rule specifically looks for service image paths containing '\Users\Public\', '\Perflogs\', '\ADMIN$\' or '\Temp\'.
Detects the installation of a DNS plugin DLL by monitoring modifications to the 'ServerLevelPluginDll' registry parameter. This technique can be used by adversaries to execute arbitrary code within the context of the DNS server, often requiring a restart of the DNS service to take effect. This can lead to privilege escalation and persistence on a compromised system.
Detects potential COM object hijacking by monitoring modifications to the default values of InprocServer32 or LocalServer32 subkeys within specific CLSIDs in the Windows Registry. The rule specifically looks for these modifications occurring in suspicious file system locations commonly used by adversaries for persistence or staging.
Page 237 of 680